Ivanti EPM
33 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-37376 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 3.2 % | ||
| CVE-2024-34787 | 2024 November Security Update – < 2024 November Security Update | Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthent | HIGH 7.8 | 18 % | ||
| CVE-2024-34784 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 1.7 % | ||
| CVE-2024-34782 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 1.7 % | ||
| CVE-2024-34781 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 68 % | ||
| CVE-2024-34780 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 1.7 % | ||
| CVE-2024-32847 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 3.2 % | ||
| CVE-2024-32844 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 1.7 % | ||
| CVE-2024-32841 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 3.4 % | ||
| CVE-2024-32839 | 2024 November Security Update – < 2024 November Security Update ; 2022 SU6 November Security Update – < 2022 SU6 November Security Update | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authentic | HIGH 7.2 | 3.4 % | ||
| CVE-2024-37397 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allow | HIGH 8.2 | 59 % | ||
| CVE-2024-34785 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 25 % | ||
| CVE-2024-34783 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 43 % | ||
| CVE-2024-34779 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 24 % | ||
| CVE-2024-32848 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 43 % | ||
| CVE-2024-32846 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 2.1 % | ||
| CVE-2024-32845 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 24 % | ||
| CVE-2024-32843 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 2.1 % | ||
| CVE-2024-32842 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 2.1 % | ||
| CVE-2024-32840 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p | CRITICAL 9.1 | 25 % | ||
| CVE-2024-29847 | 2024 September Security Update – < 2024 September Security Update ; 2022 SU6 – < 2022 SU6 | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenti | CRITICAL 10.0 | 52 % | ||
| CVE-2024-37381 | 2024 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network t | HIGH 8.4 | 3.1 % | ||
| CVE-2024-29846 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same | HIGH 8.4 | 8.5 % | ||
| CVE-2024-29830 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same | HIGH 8.4 | 8.5 % | ||
| CVE-2024-29829 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same | HIGH 8.4 | 8.2 % | ||
| CVE-2024-29828 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same | HIGH 8.4 | 8.5 % | ||
| CVE-2024-29827 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam | CRITICAL 9.6 | 72 % | ||
| CVE-2024-29826 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam | CRITICAL 9.6 | 100 % | ||
| CVE-2024-29825 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam | CRITICAL 9.6 | 100 % | ||
| CVE-2024-29824 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam | CRITICAL 9.6 | 100 % | KEV | |
| CVE-2024-29823 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam | CRITICAL 9.6 | 100 % | ||
| CVE-2024-29822 | 2022 SU5 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam | CRITICAL 9.6 | 64 % | ||
| CVE-2024-22058 | 2021 | A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated | HIGH 7.8 | 0.4 % |